Sunday, July 17, 2011

Is the Facebook safe place?

(followed by Devil's Blog on Security)

At the beginning I'd like to inform that goal of this material is not to encourage anyone to get somebody else credential to his Facebook account. It should only show that the Internet is not a safe place and utilizing of public computers can end in more or less harmful way. This scenario is simplified due to the fact that it should only show some things and not provide solution for cyber criminals.
1. Open the Wireshark and start capturing packets.
2. Open you browser, go to the Facebook web page and log into it.
3. Stop capturing the packets by the Wireshark and look for a Cookie string inside of the captured contents (Ctrl+F will be helpful...)
4. When you find the contents like this, copy the value of Cookie variable to the any notepad.
5. Open N Edit and add each of variables stored in your notepad separately. For example for xs variable you should do like this shows
6. At the end open the browser on the main Facebook page - you are logged in without asking about any credentials.

If you are working on a Windows machine, you can ommit the Wireshark section and use the script written by Marcus Murray (I've done only some little changes inside of it) which looks like

ngrep -d 1 -W byline "Host: www.facebook.com|Cookie:" | findstr "^Cooki
e:"

It shows cookies information for all sessions connected to the Facebook (of course ngrep and wpcap should be installed on the machine).

Enjoy!

No comments:

Search This Blog